CVE-2026-126296

CVSS 6.3 (medium) · published 2026-11-13

NLTK before 3.10.4 contains a path traversal vulnerability in save_maxent_params() and load_maxent_params() that bypasses the pathsec filesystem restriction mechanism. Attackers who control the tab_dir argument can read or overwrite model parameter files outside permitted data roots, because the functions call Python's built-in open() directly.

Weakness: CWE-73

Source: NVD CVE-2026-126296

References

• https://github.com/nltk/nltk/security/advisories/GHSA-59f9-gqg8-mqpj
• https://www.vulncheck.com/advisories/nltk-before-3.10.4-path-traversal-via-save-maxent-params-and-load-maxent-params

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.